breitbandmessung-bin

maintainer endos · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Electron .deb binary from download.breitbandmessung.de, which is the official vendor download host for the Bundesnetzagentur's Breitbandmessung tool (a German federal broadband measurement application). This is not a random personal host — it is the legitimate upstream distribution point for this proprietary application. The binary is checksummed (sha256). The SKIP on the LICENSE file is sloppy but the LICENSE is pure data with no security impact. The build() step patches the Electron app.asar to spoof lsb_release output so the app runs on Arch Linux — this is a standard compatibility shim for Electron apps that check the distro. Overall this is a prebuilt proprietary binary from the official vendor host, which inherently carries medium supply-chain risk (no source build, closed binary), but there is no evidence of malice, unofficial hosting, or obfuscation. The medium rating is appropriate solely because it installs an unauditable prebuilt binary/Electron app from a proprietary vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("breitbandmessung-${pkgver}.deb::https://download.breitbandmessung.de/bbm/Breitbandmessung-linux.deb" "LICENSE")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Electron .deb binary from download.breitbandmessung.de, which is the official vendor download host for the Bundesnetzagentur's Breitbandmessung tool (a German federal broadband measurement application). This is not a random personal host — it is the legitimate upstream distribution point for this proprietary application. The binary is checksummed (sha256). The SKIP on the LICENSE file is sloppy but the LICENSE is pure data with no security impact. The build() step patches the Electron app.asar to spoof lsb_release output so the app runs on Arch Linux — this is a standard compatibility shim for Electron apps that check the distro. Overall this is a prebuilt proprietary binary from the official vendor host, which inherently carries medium supply-chain risk (no source build, closed binary), but there is no evidence of malice, unofficial hosting, or obfuscation. The medium rating is appropriate solely because it installs an unauditable prebuilt binary/Electron app from a proprietary vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vincent Ceylan <aur@egn.mozmail.com>
    
      2# Contributor: Posi <posi1981@gmail.com>
    
      3# Contributor: Linus Dierheimer <Linus@Dierheimer.de>
    
      4
    
      5pkgname=breitbandmessung-bin
    
      6pkgver=3.11.0
    
      7pkgrel=1
    
      8pkgdesc="Die Breitbandmessung Desktop-App erlaubt es Ihnen, die tatsächliche Datenübertragungsrate Ihres Breitbandanschlusses zu messen. Weitere Informationen erhalten Sie unter https://breitbandmessung.de"
    
      9arch=('x86_64')
    
      10license=('custom:proprietary-zafaco-GmbH')
    
      11url="https://breitbandmessung.de/desktop-app"
    
      12options=('!strip')
    
      13source=("breitbandmessung-${pkgver}.deb::https://download.breitbandmessung.de/bbm/Breitbandmessung-linux.deb" "LICENSE")
    
      14sha256sums=("90db91fb370a11d67da741c46a39854374c8533d73d80a34f7c40d08aeb1e658" "SKIP")
    
      15depends=("net-tools")
    
      16makedepends=("asar")
    
      17provides=("breitbandmessung=${pkgver}")
    
      18conflicts=("breitbandmessung")
    
      19replaces=("breitbandmessung<=3.9.0")
    
      20
    
      21build() {
    
      22    _builddir="${srcdir}/${pkgver}-${pkgrel}"
    
      23    mkdir -p "${_builddir}"
    
      24
    
      25    tar --extract --overwrite --file=data.tar.xz --directory="${_builddir}"
    
      26
    
      27    cd "${_builddir}/opt/Breitbandmessung/resources/"
    
      28
    
      29    _unpatched="lsbRelease()"
    
      30    _patched='{ "distributorID": "Debian", "release": "8", "description": "Debian" }'
    
      31
    
      32    asar e app.asar unpacked/
    
      33    sed -i "s/${_unpatched}/${_patched}/g" unpacked/build/electron.js
    
      34    asar p unpacked/ app.asar
    
      35    rm -rf unpacked/
    
      36}
    
      37
    
      38package() {
    
      39    cp -a "${srcdir}/${pkgver}-${pkgrel}/." "${pkgdir}"
    
      40
    
      41    #Create /usr/bin symlink
    
      42    mkdir -p "${pkgdir}/usr/bin/"
    
      43    ln -sf "/opt/Breitbandmessung/breitbandmessung" "${pkgdir}/usr/bin/breitbandmessung"
    
      44
    
      45    chmod -R go-w "${pkgdir}/usr"
    
      46
    
      47    install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2